3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A database log shows multiple failed login attempts from the same user account followed by a successful login. Which type of event does this pattern most likely indicate?

   • AA SQL injection attempt
   • BA normal user forgetting their password
   • CA brute-force attack
   • DA denial-of-service attack
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Windows analyst opens Event Viewer and sees Event ID 4624 with Logon Type 10 for a user account at 2:00 AM. The user is a standard employee who works 9–5. Which additional log field would most strongly confirm a malicious remote login rather than a local console login?

   • AThe Workstation Name field shows the user's own computer name
   • BThe Source Network Address field shows a public IP address
   • CThe Logon Process field shows 'User32'
   • DThe Authentication Package field shows 'Kerberos'
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Windows administrator is investigating a possible privilege escalation. The security log shows Event ID 4672 (special privileges assigned to new logon) for a standard user account. The administrator also sees Event ID 4688 (process creation) for 'cmd.exe' with a parent process of 'explorer.exe'. Which additional event should the administrator look for to confirm the privilege escalation?

   • AEvent ID 4732 (a member was added to a security-enabled local group)
   • BEvent ID 4624 (successful logon)
   • CEvent ID 4634 (logoff)
   • DEvent ID 4656 (handle to an object requested)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOAR platform log shows that a playbook named 'Contain_Threat' executed a series of actions: it quarantined a file, blocked an IP address on the firewall, and created a ticket in the ticketing system. The log entry for the 'block IP' action shows a status of 'failed'. What is the most appropriate next step for the analyst?

   • AIgnore the failure because the other actions succeeded
   • BCheck the firewall's API logs to determine why the action failed
   • CManually block the IP on the firewall without further investigation
   • DRe-run the entire playbook to ensure all actions complete
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a SIEM, what is the primary purpose of a search query?

   • ATo retrieve and filter log data from the indexed sources
   • BTo configure network firewall rules
   • CTo encrypt log data at rest
   • DTo automatically remediate security incidents
   Reveal Solution Discussion Select an answer first